@devdogsuga/devtools 0.1.0

package/dist/gh/rulesets/desired.js

@@ -0,0 +1,247 @@
+/**
+ * Canonical fixed-ruleset name -> earlier name(s) this reconciler recognizes
+ * as the SAME slot, so the first run renames rather than creating a
+ * duplicate that leaves the old one live and unmanaged.
+ *
+ * Only `main` has a legacy alias today (`main-protection`, live on GitHub as
+ * of 2026-09-24). `production`, `~ALL` and `team/**` have no live ruleset to
+ * rename — they are created fresh. The tag ruleset keeps its live name,
+ * `tag-protection`, unchanged; nothing about its shape is wrong today, so
+ * there is no rename to make.
+ */
+export const LEGACY_NAME_ALIASES = {
+    main: ["main-protection"],
+};
+/** Ruleset names this reconciler deletes outright — nothing in the desired set replaces them. */
+export const DELETE_RULESET_NAMES = ["comp-branches"];
+/**
+ * A live ruleset name this reconciler must NEVER touch: one `teamSync.ts`
+ * created and owns (`team/<slug>`, an exact-ref ruleset), as opposed to the
+ * `team/**` wildcard-creation ruleset this module itself manages.
+ *
+ * `teamRulesetName()` in DevDogsUGA's `rulesets.ts` builds these as
+ * `team/${slug}`, and slugs never contain `/`, so a live name is a per-team
+ * ruleset iff it starts with `team/` and is not the literal `team/**` this
+ * reconciler owns.
+ */
+export function isPerTeamRulesetName(name) {
+    return name.startsWith("team/") && name !== "team/**";
+}
+/**
+ * The five fixed rulesets, built from resolved actor ids.
+ *
+ * Pure — no network, no `gh` — so `desired.test.ts` can assert the shape
+ * without mocking anything, and `commands.ts` calls this only after
+ * resolving `RulesetActors` from the live org.
+ */
+export function buildDesiredRulesets(actors) {
+    return [
+        {
+            name: "main",
+            target: "branch",
+            enforcement: "active",
+            conditions: {
+                ref_name: { include: ["refs/heads/main"], exclude: [] },
+            },
+            // `devops` bypasses everything on `main`, including a direct push in
+            // an emergency — unlike `production`, there is no deploy on the other
+            // side of a `main` push, so `always` (not `pull_request`-only) is the
+            // right bypass mode here.
+            bypass_actors: [
+                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+            ],
+            rules: [
+                { type: "deletion" },
+                { type: "non_fast_forward" },
+                // The bug this closes: `main-protection` carried `deletion` and
+                // `non_fast_forward` only, so a plain `git push origin main` landed
+                // directly. `update` restricts that to bypass actors.
+                {
+                    type: "update",
+                    parameters: { update_allows_fetch_and_merge: false },
+                },
+                // Competition entries merge into `main` by squash — one commit per
+                // entry, not the team branch's whole history.
+                {
+                    type: "pull_request",
+                    parameters: {
+                        allowed_merge_methods: ["squash"],
+                        dismiss_stale_reviews_on_push: false,
+                        require_code_owner_review: false,
+                        require_last_push_approval: false,
+                        required_approving_review_count: 0,
+                        required_review_thread_resolution: false,
+                    },
+                },
+            ],
+        },
+        {
+            name: "production",
+            target: "branch",
+            enforcement: "active",
+            conditions: {
+                ref_name: { include: ["refs/heads/production"], exclude: [] },
+            },
+            // A push to `production` deploys (see `GITHUB_COMPETITION_REPO`'s doc
+            // in DevDogsUGA's env.ts: "the production branch, not a second repo,
+            // is the deploy boundary"). `devops` bypasses on PULL REQUESTS only —
+            // `bypass_mode: "pull_request"` — so a Promote PR still needs the
+            // code-owner review below even from devops; only a direct push
+            // outside a PR bypasses freely, which devops should not have either
+            // for the deploy boundary. Kept at `pull_request` rather than
+            // dropping the bypass entirely because devops still needs to be able
+            // to merge a Promote PR without waiting on a second reviewer when
+            // nobody else is around.
+            bypass_actors: [
+                {
+                    actor_id: actors.devopsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "pull_request",
+                },
+            ],
+            rules: [
+                { type: "deletion" },
+                { type: "non_fast_forward" },
+                {
+                    type: "update",
+                    parameters: { update_allows_fetch_and_merge: false },
+                },
+                // Promote PRs merge as a single merge commit — `production`'s
+                // history should read as one commit per promotion, traceable back
+                // to the `main` state it promoted.
+                {
+                    type: "pull_request",
+                    parameters: {
+                        allowed_merge_methods: ["merge"],
+                        dismiss_stale_reviews_on_push: false,
+                        require_code_owner_review: true,
+                        require_last_push_approval: false,
+                        required_approving_review_count: 1,
+                        required_review_thread_resolution: false,
+                    },
+                },
+            ],
+        },
+        {
+            // `~ALL` is GitHub's own wildcard for "every branch in the
+            // repository" (`target: "branch"` scopes it to `refs/heads/*`, never
+            // tags). It exists to close the gap `teamSync.ts`'s header names
+            // directly: every team member holds a repository-wide `push` grant,
+            // because GitHub team permissions have no branch dimension, so
+            // WITHOUT this ruleset any team member can push straight to any
+            // branch that is not their own team's — including `main` and
+            // `production`, if either of THOSE rulesets were ever misconfigured,
+            // and including any other stray branch nothing else names. This is
+            // deliberately the blunt, redundant backstop.
+            //
+            // TASK-324's access-control checklist requires refusing a non-admin
+            // member who tries to CREATE an arbitrary new branch too, not only
+            // push to an existing one — `creation`, `deletion` and
+            // `non_fast_forward` join `update` here for that. `grep`-verified
+            // (2026-09-24) that no platform code path (`teamSync.ts`, the rest of
+            // `server/github/`) ever creates, deletes or force-pushes a ref
+            // outside `refs/heads/team/**` — `cutTeamBranch`'s `createRef` is the
+            // only ref-creation call in the app, and it targets a team ref, which
+            // `~ALL` already excludes. So the platform's own App does NOT bypass
+            // `~ALL`; nothing here needs it to.
+            name: "~ALL",
+            target: "branch",
+            enforcement: "active",
+            conditions: {
+                ref_name: {
+                    include: ["~ALL"],
+                    // MUST exclude `team/**`: rules aggregate across rulesets, and a
+                    // per-team ruleset's bypass (its own team, `always`) does not
+                    // exempt that team from a DIFFERENT ruleset's `update` rule
+                    // matching the same ref (`rulesets.ts`'s constraint 2). Without
+                    // this exclude, every team would be correctly bypassing its own
+                    // per-team ruleset and STILL blocked here — readable, unpushable,
+                    // and the cause invisible from either ruleset read alone.
+                    exclude: ["refs/heads/team/**"],
+                },
+            },
+            bypass_actors: [
+                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+                // Renovate (TASK-299) creates and updates `renovate/*` branches for
+                // its dependency-update PRs — an ordinary bot workflow, not a hole,
+                // so it bypasses the same way the platform App bypasses `team/**`.
+                // Conditional: the App may not be installed yet, in which case
+                // `commands.ts` never resolves an id for it and this entry is
+                // omitted rather than the whole plan failing — see
+                // `RulesetActors.renovateAppId`'s doc.
+                ...(actors.renovateAppId !== undefined
+                    ? [
+                        {
+                            actor_id: actors.renovateAppId,
+                            actor_type: "Integration",
+                            bypass_mode: "always",
+                        },
+                    ]
+                    : []),
+            ],
+            rules: [
+                {
+                    type: "update",
+                    parameters: { update_allows_fetch_and_merge: false },
+                },
+                { type: "creation" },
+                { type: "deletion" },
+                { type: "non_fast_forward" },
+            ],
+        },
+        {
+            // `creation`, `deletion` and `non_fast_forward` — deliberately NOT
+            // `update`. Pushes to a team's own branch stay governed entirely by
+            // that team's per-team ruleset (`teamRulesetPayload`, which grants
+            // exactly that team `update`+`deletion` bypass on its own ref); this
+            // ruleset must not add a SECOND `update` rule here, because rules
+            // aggregate and only the App/devops bypass this one — an `update` rule
+            // here would block every team's own pushes despite their per-team
+            // ruleset correctly bypassing (`rulesets.ts`'s constraint 2, the exact
+            // failure this file's header already warns about).
+            //
+            // `deletion` and `non_fast_forward`, by contrast, are SAFE to add here
+            // precisely because they aggregate: a team bypasses its own per-team
+            // ruleset's `deletion` rule, but is not a bypass actor on THIS one, so
+            // the aggregate result is that nobody but the App or devops can delete
+            // or force-push any `team/**` branch — including a team acting on its
+            // own. See `rulesets.ts`'s `teamRulesetPayload` doc, updated alongside
+            // this file, for what that changes about the per-team ruleset's own
+            // "right trade" reasoning.
+            name: "team/**",
+            target: "branch",
+            enforcement: "active",
+            conditions: {
+                ref_name: { include: ["refs/heads/team/**"], exclude: [] },
+            },
+            bypass_actors: [
+                { actor_id: actors.appId, actor_type: "Integration", bypass_mode: "always" },
+                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+            ],
+            rules: [
+                { type: "creation" },
+                { type: "deletion" },
+                { type: "non_fast_forward" },
+            ],
+        },
+        {
+            // The tag ruleset `rulesets.ts`'s constraint 3 counts toward the fixed
+            // cost but never named a shape for. Kept at its live name,
+            // `tag-protection` — nothing about its current shape is the bug this
+            // task fixes, so there is no rename to make, only a shape to hold
+            // steady (a plan against the live fixture is a no-op here; see
+            // `diff.test.ts`'s idempotence case).
+            name: "tag-protection",
+            target: "tag",
+            enforcement: "active",
+            conditions: {
+                ref_name: { include: ["refs/tags/**"], exclude: [] },
+            },
+            bypass_actors: [
+                { actor_id: actors.adminsTeamId, actor_type: "Team", bypass_mode: "always" },
+                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+            ],
+            rules: [{ type: "creation" }, { type: "update" }, { type: "deletion" }],
+        },
+    ];
+}

package/dist/gh/rulesets/diff.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Live ruleset list -> a plan of creates/updates/deletes/no-ops, against
+ * `desired.ts`'s five fixed rulesets.
+ *
+ * Every live ruleset is classified exactly once, by name, into one of four
+ * buckets — and the classification is what makes this reconciler safe to
+ * re-run against a live org: it only ever writes to a ruleset it can name a
+ * reason for touching.
+ *
+ *   1. A per-team ruleset (`isPerTeamRulesetName`) — owned by
+ *      `teamSync.ts` in DevDogsUGA. Never read past its name, never
+ *      diffed, never appears in any action list. `blast radius` here is
+ *      the whole point: a bug that let this reconciler touch a team's
+ *      ruleset would silently rewrite that team's own bypass actor.
+ *   2. Named in `DELETE_RULESET_NAMES` — deleted outright.
+ *   3. The canonical name (or a `LEGACY_NAME_ALIASES` entry) of a desired
+ *      ruleset — created if absent, updated (by id, renamed if the alias
+ *      matched) if its live shape differs, left as a no-op if it already
+ *      matches.
+ *   4. Anything else — reported, never touched. An unrecognized ruleset is
+ *      as likely to be something Sloan added by hand for a reason this
+ *      reconciler doesn't know as it is to be drift, and only
+ *      `DELETE_RULESET_NAMES` is trusted to mean "remove this".
+ */
+import { type RulesetActors } from "./desired.js";
+import type { DesiredRuleset, LiveRuleset, LiveRulesetSummary } from "./types.js";
+export interface CreateAction {
+    kind: "create";
+    desired: DesiredRuleset;
+}
+export interface UpdateAction {
+    kind: "update";
+    id: number;
+    /** The live ruleset's current name, when different from `desired.name` — a rename is part of this update. */
+    liveName: string;
+    desired: DesiredRuleset;
+}
+export interface DeleteAction {
+    kind: "delete";
+    id: number;
+    name: string;
+}
+export interface NoopEntry {
+    name: string;
+    id: number;
+}
+export interface RulesetPlan {
+    creates: CreateAction[];
+    updates: UpdateAction[];
+    deletes: DeleteAction[];
+    noops: NoopEntry[];
+    /** Per-team rulesets seen live, by name — reported for visibility, never acted on. */
+    perTeamSkipped: string[];
+    /** Live rulesets that matched no desired slot and no delete name — reported, never acted on. */
+    unmanaged: string[];
+}
+/**
+ * Builds the plan. `liveDetails` must carry one fully-fetched `LiveRuleset`
+ * for every summary in `liveSummaries` EXCEPT per-team ones — `commands.ts`
+ * is expected to skip fetching those, since there can be up to ~70 of them
+ * and this reconciler never reads past their name either way.
+ */
+export declare function planRulesets(liveSummaries: readonly LiveRulesetSummary[], liveDetails: ReadonlyMap<number, LiveRuleset>, actors: RulesetActors, desiredRulesets: readonly DesiredRuleset[]): RulesetPlan;
+/** Whether a plan would write anything at all. */
+export declare function planHasChanges(plan: RulesetPlan): boolean;

package/dist/gh/rulesets/diff.js

@@ -0,0 +1,134 @@
+/**
+ * Live ruleset list -> a plan of creates/updates/deletes/no-ops, against
+ * `desired.ts`'s five fixed rulesets.
+ *
+ * Every live ruleset is classified exactly once, by name, into one of four
+ * buckets — and the classification is what makes this reconciler safe to
+ * re-run against a live org: it only ever writes to a ruleset it can name a
+ * reason for touching.
+ *
+ *   1. A per-team ruleset (`isPerTeamRulesetName`) — owned by
+ *      `teamSync.ts` in DevDogsUGA. Never read past its name, never
+ *      diffed, never appears in any action list. `blast radius` here is
+ *      the whole point: a bug that let this reconciler touch a team's
+ *      ruleset would silently rewrite that team's own bypass actor.
+ *   2. Named in `DELETE_RULESET_NAMES` — deleted outright.
+ *   3. The canonical name (or a `LEGACY_NAME_ALIASES` entry) of a desired
+ *      ruleset — created if absent, updated (by id, renamed if the alias
+ *      matched) if its live shape differs, left as a no-op if it already
+ *      matches.
+ *   4. Anything else — reported, never touched. An unrecognized ruleset is
+ *      as likely to be something Sloan added by hand for a reason this
+ *      reconciler doesn't know as it is to be drift, and only
+ *      `DELETE_RULESET_NAMES` is trusted to mean "remove this".
+ */
+import { DELETE_RULESET_NAMES, LEGACY_NAME_ALIASES, isPerTeamRulesetName, } from "./desired.js";
+/**
+ * Fills in defaults GitHub omits on the wire so an absent field and an
+ * explicit default-valued one compare equal — see `UpdateRule.parameters`'s
+ * doc in `types.ts`.
+ */
+function canonicalizeRule(rule) {
+    if (rule.type === "update") {
+        return {
+            type: "update",
+            parameters: {
+                update_allows_fetch_and_merge: rule.parameters?.update_allows_fetch_and_merge ?? false,
+            },
+        };
+    }
+    return rule;
+}
+function sortRules(rules) {
+    return [...rules]
+        .map(canonicalizeRule)
+        .sort((a, b) => a.type.localeCompare(b.type));
+}
+function sortActors(actors) {
+    return [...actors].sort((a, b) => a.actor_type.localeCompare(b.actor_type) || a.actor_id - b.actor_id);
+}
+/**
+ * A canonical, order-independent string for one ruleset's PROTECTION shape —
+ * everything except its name and id. Two rulesets that protect identically
+ * but list their rules or bypass actors in a different order must compare
+ * equal; GitHub does not promise a stable order for either.
+ */
+function fingerprint(r) {
+    return JSON.stringify({
+        target: r.target,
+        enforcement: r.enforcement,
+        conditions: {
+            ref_name: {
+                include: [...r.conditions.ref_name.include].sort(),
+                exclude: [...r.conditions.ref_name.exclude].sort(),
+            },
+        },
+        bypass_actors: sortActors(r.bypass_actors),
+        rules: sortRules(r.rules),
+    });
+}
+/** Every name a live ruleset could carry and still BE `desired` — its canonical name plus any legacy alias. */
+function candidateNames(desired) {
+    return [desired.name, ...(LEGACY_NAME_ALIASES[desired.name] ?? [])];
+}
+/**
+ * Builds the plan. `liveDetails` must carry one fully-fetched `LiveRuleset`
+ * for every summary in `liveSummaries` EXCEPT per-team ones — `commands.ts`
+ * is expected to skip fetching those, since there can be up to ~70 of them
+ * and this reconciler never reads past their name either way.
+ */
+export function planRulesets(liveSummaries, liveDetails, actors, desiredRulesets) {
+    const plan = {
+        creates: [],
+        updates: [],
+        deletes: [],
+        noops: [],
+        perTeamSkipped: [],
+        unmanaged: [],
+    };
+    const matchedLiveIds = new Set();
+    for (const desired of desiredRulesets) {
+        const names = candidateNames(desired);
+        const live = liveSummaries.find((s) => names.includes(s.name));
+        if (!live) {
+            plan.creates.push({ kind: "create", desired });
+            continue;
+        }
+        matchedLiveIds.add(live.id);
+        const detail = liveDetails.get(live.id);
+        if (!detail) {
+            throw new Error(`planRulesets: no detail fetched for live ruleset "${live.name}" (id ${live.id})`);
+        }
+        const renamed = detail.name !== desired.name;
+        const drifted = fingerprint(detail) !== fingerprint(desired);
+        if (renamed || drifted) {
+            plan.updates.push({
+                kind: "update",
+                id: live.id,
+                liveName: detail.name,
+                desired,
+            });
+        }
+        else {
+            plan.noops.push({ name: desired.name, id: live.id });
+        }
+    }
+    for (const live of liveSummaries) {
+        if (matchedLiveIds.has(live.id))
+            continue;
+        if (isPerTeamRulesetName(live.name)) {
+            plan.perTeamSkipped.push(live.name);
+            continue;
+        }
+        if (DELETE_RULESET_NAMES.includes(live.name)) {
+            plan.deletes.push({ kind: "delete", id: live.id, name: live.name });
+            continue;
+        }
+        plan.unmanaged.push(live.name);
+    }
+    return plan;
+}
+/** Whether a plan would write anything at all. */
+export function planHasChanges(plan) {
+    return (plan.creates.length > 0 || plan.updates.length > 0 || plan.deletes.length > 0);
+}

package/dist/gh/rulesets/types.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The shapes this reconciler reads and writes.
+ *
+ * Deliberately a narrower slice of GitHub's repository-ruleset schema than
+ * Octokit's generated types (devtools has no Octokit dependency — every
+ * GitHub call in this package goes through the `gh` CLI, see `../client.ts`'s
+ * header for why). Only the rule types and bypass-actor shapes this
+ * reconciler actually emits are represented; a rule type nothing here builds
+ * is deliberately unrepresentable, the same reasoning
+ * `apps/platform/src/server/github/rulesets.ts`'s `RulesetRule` gives for
+ * doing the same with a smaller set.
+ */
+export type RulesetTarget = "branch" | "tag";
+export interface BypassActor {
+    actor_id: number;
+    actor_type: "Team" | "Integration";
+    bypass_mode: "always" | "pull_request";
+}
+export interface UpdateRule {
+    type: "update";
+    parameters?: {
+        update_allows_fetch_and_merge: boolean;
+    };
+}
+export interface DeletionRule {
+    type: "deletion";
+}
+export interface NonFastForwardRule {
+    type: "non_fast_forward";
+}
+export interface CreationRule {
+    type: "creation";
+}
+export interface PullRequestRule {
+    type: "pull_request";
+    parameters: {
+        allowed_merge_methods: ("merge" | "squash" | "rebase")[];
+        dismiss_stale_reviews_on_push: boolean;
+        require_code_owner_review: boolean;
+        require_last_push_approval: boolean;
+        required_approving_review_count: number;
+        required_review_thread_resolution: boolean;
+    };
+}
+export type Rule = UpdateRule | DeletionRule | NonFastForwardRule | CreationRule | PullRequestRule;
+export interface RulesetConditions {
+    ref_name: {
+        include: string[];
+        exclude: string[];
+    };
+}
+/** What this reconciler wants a ruleset to look like, name included. */
+export interface DesiredRuleset {
+    name: string;
+    target: RulesetTarget;
+    enforcement: "active";
+    bypass_actors: BypassActor[];
+    conditions: RulesetConditions;
+    rules: Rule[];
+}
+/** One entry from `GET /repos/{owner}/{repo}/rulesets` — name and id only. */
+export interface LiveRulesetSummary {
+    id: number;
+    name: string;
+    target?: string;
+}
+/** The full shape from `GET /repos/{owner}/{repo}/rulesets/{id}`. */
+export interface LiveRuleset {
+    id: number;
+    name: string;
+    target: RulesetTarget;
+    enforcement: string;
+    bypass_actors: BypassActor[];
+    conditions: RulesetConditions;
+    rules: Rule[];
+}

package/dist/gh/rulesets/types.js

@@ -0,0 +1,13 @@
+/**
+ * The shapes this reconciler reads and writes.
+ *
+ * Deliberately a narrower slice of GitHub's repository-ruleset schema than
+ * Octokit's generated types (devtools has no Octokit dependency — every
+ * GitHub call in this package goes through the `gh` CLI, see `../client.ts`'s
+ * header for why). Only the rule types and bypass-actor shapes this
+ * reconciler actually emits are represented; a rule type nothing here builds
+ * is deliberately unrepresentable, the same reasoning
+ * `apps/platform/src/server/github/rulesets.ts`'s `RulesetRule` gives for
+ * doing the same with a smaller set.
+ */
+export {};

package/dist/gh/settings/api.d.ts

@@ -0,0 +1,40 @@
+import type { LiveActionsPermissions, LiveAutomatedSecurityFixes, LiveBranchPolicy, LiveDeploymentBranchPolicy, LiveEnvironment, LiveRepo, LiveSecurityAndAnalysis, LiveSelectedActions, LiveWorkflowPermissions } from "./types.js";
+export declare class GhSettingsError extends Error {
+}
+/** `owner/repo`, e.g. `DevDogsUGA/DevDogsUGA`. */
+export interface Repo {
+    owner: string;
+    repo: string;
+}
+export declare function getRepo(r: Repo): Promise<LiveRepo>;
+export declare function patchSecurityAndAnalysis(r: Repo, fields: Partial<LiveSecurityAndAnalysis>): Promise<void>;
+/**
+ * `GET /repos/{owner}/{repo}/vulnerability-alerts` returns 204 with an
+ * empty body when Dependabot alerts are on, and 404 when they are off — the
+ * one endpoint in this file with no JSON to parse either way.
+ */
+export declare function getVulnerabilityAlertsEnabled(r: Repo): Promise<boolean>;
+export declare function setVulnerabilityAlertsEnabled(r: Repo, enabled: boolean): Promise<void>;
+export declare function getAutomatedSecurityFixes(r: Repo): Promise<LiveAutomatedSecurityFixes>;
+export declare function setAutomatedSecurityFixesEnabled(r: Repo, enabled: boolean): Promise<void>;
+export declare function getActionsPermissions(r: Repo): Promise<LiveActionsPermissions>;
+export declare function setActionsPermissions(r: Repo, body: LiveActionsPermissions): Promise<void>;
+/**
+ * `GET .../actions/permissions/selected-actions` 409s outright when the
+ * repository's `allowed_actions` is not currently `"selected"` — there is
+ * no selected-actions allowlist to read when nothing restricts to one.
+ * Read as the empty, nothing-allowed list rather than propagating the
+ * error: `diff.ts` then reports the honest drift (every field disagrees
+ * with `desired.actions`) instead of `commands.ts` failing outright before
+ * it can report anything.
+ */
+export declare function getSelectedActions(r: Repo): Promise<LiveSelectedActions>;
+export declare function setSelectedActions(r: Repo, body: LiveSelectedActions): Promise<void>;
+export declare function getWorkflowPermissions(r: Repo): Promise<LiveWorkflowPermissions>;
+export declare function setWorkflowPermissions(r: Repo, body: LiveWorkflowPermissions): Promise<void>;
+/** `null` when the environment does not exist yet — reported, never created here. */
+export declare function getEnvironment(r: Repo, name: string): Promise<LiveEnvironment | null>;
+export declare function getDeploymentBranchPolicies(r: Repo, name: string): Promise<LiveBranchPolicy[]>;
+export declare function setDeploymentBranchPolicyMode(r: Repo, name: string, mode: LiveDeploymentBranchPolicy): Promise<void>;
+export declare function addDeploymentBranchPolicy(r: Repo, name: string, pattern: string): Promise<void>;
+export declare function deleteDeploymentBranchPolicy(r: Repo, name: string, policyId: number): Promise<void>;